You are using a single laptop with an external Wi-Fi adapter to perform wardriving and geolocate a rogue AP. You need to estimate the AP's location as accurately as possible. Which approach will yield the best results?

Set the adapter to channel hop rapidly to capture the AP on all channels.

Use a single high-gain directional antenna and point it in the direction of the strongest signal.

Drive slowly and capture multiple beacons from the AP at different locations, logging GPS coordinates and RSSI.

Use a GPS logger and capture only the first beacon from the AP.

GIAC Network Forensic Analyst

Domain 4Objective 2

Wireless Network Analysis GNFA Practice Questions (Page 6)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 26–30

26foundation · easy
Which frame type in a WPA2 handshake capture is essential for an offline dictionary attack?
Select an answer first
27foundation · easy
Which 802.11 management frame is commonly used by an attacker to forcibly disconnect a client from an access point?
Select an answer first
28foundation · easy
In an 802.11 wireless capture, which frame type is used by a client to request association with an access point?
Select an answer first
29expert · hard
You are using a single laptop with an external Wi-Fi adapter to perform wardriving and geolocate a rogue AP. You need to estimate the AP's location as accurately as possible. Which approach will yield the best results?
Select an answer first
30foundation · easy
Which field in an 802.11 frame is used to detect retransmissions and duplicate frames?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Wireless Network Analysis GNFA Practice Questions (Page 6)

Questions 26–30

Which frame type in a WPA2 handshake capture is essential for an offline dictionary attack?

Which 802.11 management frame is commonly used by an attacker to forcibly disconnect a client from an access point?

In an 802.11 wireless capture, which frame type is used by a client to request association with an access point?

You are using a single laptop with an external Wi-Fi adapter to perform wardriving and geolocate a rogue AP. You need to estimate the AP's location as accurately as possible. Which approach will yield the best results?

Which field in an 802.11 frame is used to detect retransmissions and duplicate frames?

Keep studying — Advanced Analysis Techniques